Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Encryption Security

Enigmail Standard In Mandrake 9.0 181

Posted by timothy from the ease-of-use dept.
AxelTorvalds writes "The Mozilla 1.1 RPMs in Mandrake 9.0 contain the enigmail plugin. It seemlessly encrypts, signs, decrypts and authenticate email with GPG or PGP in the Mozilla Mail client. This is the first major distributor I know of to support enigmail. With this and Evolution and Kmail both supporting GPG and PGP are we at the dawn of that golden age when encrypted email will be commonplace?" Update: 09/15 17:26 GMT by T : Borked link fixed.
This discussion has been archived. No new comments can be posted.

Enigmail Standard In Mandrake 9.0 More

Enigmail Standard In Mandrake 9.0

Comments Filter:

  • This is of course the correct link [mozdev.org].

  • Excellent... except (Score:2, Interesting)

    by gmplague ( 412185 )
    Excellent, except as I recall, Microsoft Outlook has had this ability since the release of Windows XP... sure it's not GPG and PGP messages, but it's seamless strong encryption. I love mandrake though, and this is a great step. Good work team!
    • Gnus has had this ability for years.
      • Awww be quite. Mandrake has had this since rc 1 (9.0 is not out YET) but it doesn't mean this is bad. I am very glad to see this becuase it means strong encryption will be brought to people who toehrwise would not learn it. I think default strong encryption is a good idea becuase as we all know a non-techie probably wont spend time working on encrypting emails. It has to be there without them doing anyhting for it to get used.
    • "Excellent, except as I recall, Microsoft Outlook has had this ability since the release of Windows XP"

      Was not XP released many years after KMail supported encryption?

      Also to troll (sorry) what use email encryption if a virus can send the contents of your inbox + personal files to everyone in your address book?

      • "Also to troll (sorry) what use email encryption if a virus can send the contents of your inbox + personal files to everyone in your address book?"

        What use is CD copy protection when someone working at the pressing plant can steal a copy for him/herself?
        What use is 40 bit encryption when some groups have Cray X1's?

        The possibility that a rare and unlikely scenario may bypass a protection mechanism does not entirely preclude the usefulness of the mechanism.

        Encryption works great in 99% of cases where someone might be snooping.
        • gmplague:
          "Excellent, except as I recall, Microsoft Outlook has had this ability [email encryption] since the release of Windows XP."

          XPlightcycler: (in reply)
          "Also to troll (sorry) what use email encryption if a virus can send the contents of your inbox + personal files to everyone in your address book?"

          Sivar: (in reply to the reply)
          "The possibility that a rare and unlikely scenario may bypass a protection mechanism does not entirely preclude the usefulness of the mechanism."

          This [sivar's] point is valid, but I have to ask, where do Outlook's suceptability to virii/remailer worms and 'rare and unlikely' meet. Outlook (& it's cousin Outlook Express) are extremely susceptable to them, in my experience atleast. Just because these pieces of software can do good encryption doesn't make them secure, for that you would atleast need to add a third party virus scanner.
      • Also to troll (sorry) what use email encryption if a virus can send the contents of your inbox + personal files to everyone in your address book?

        <paranoia mode="tinfoil beanie">
        Or one that just mails your private keyring back to black helicopter command. It would save the NSA millennia of computer time if they could just steal keys instead of having to crack them all. If it only stole one file and then deleted itself, few users would even notice it.
        </paranoia>
    • ROT13 isn't strong encryption.

  • Shakes head (Score:3, Insightful)

    by Reality Master 101 ( 179095 ) <<moc.liamg> <ta> <101retsaMytilaeR>> on Sunday September 15, 2002 @01:24PM (#4261224) Homepage Journal

    With this and Evolution and Kmail both supporting GPG and PGP are we at the dawn of that golden age when encrypted email will be commonplace?

    Of course! Because we know that the only thing holding back encrypted e-mail is the fact that Linux didn't have it built in! (rolls eyes)

    Of course, the fact that it's extremely difficult (if not impossible) to make it fully automatic for the users has nothing to do with it.

    • Sen:te [sente.ch] has put together something that works seamlessly and automaticaly w. OS X's Mail.

      But you are right - the lack of Linux (or Mac) support is not what has kept secure email from becoming more wide-spread.

    • Re:Shakes head (Score:4, Insightful)

      by StillAnonymous ( 595680 ) on Sunday September 15, 2002 @01:44PM (#4261323)
      The important thing is that Mozilla is cross-platform so this gives almost everyone FREE access to an email client that can do all the encryption/decryption nearly transparently.

      I'd say that is indeed a big step forward.
    • A mate and I tried to setup encrypted email a couple of months back. I use evolution and he uses Pine (I Think). The hardest part was setting up the public/private keys and getting all that working. We had to do that via the command line which 'end users' wouldn't find easy. Once we had done that then it is _really_ easy to use in evolution. Simply create a new email and select 'Security|PGP Encrypt' and its done. In pine the problem was reading the email I sent. my friend had to save the attachment and then decrypt it. However sending encrypted email from pine was easy.

      I do agree though that once it is a seamless process from setup to use then it will become more popular. /b

    • Re:Shakes head (Score:3, Informative)

      by ocelotbob ( 173602 )
      Have you used the systems you're talking about, or are you just talking out of your ass again? The whole point of enigmail, which I have installed on this system, is to make it as seamless and automatic as possible to encrypt/decrypt messages. Currently, I have it set up to automatically sign my messages by default, though switching to automatic encryption is simply a matter of changing a menu option. The binary will have everything you need already installed, all you'll have to do is have it make a key.

      Just because Microsoft has made it difficult and/or impossible to have secure mail, doesn't mean other vendors have such difficulties.

      • or are you just talking out of your ass again?

        As usual, I know exactly what I'm talking about.

        The whole point of enigmail, which I have installed on this system, is to make it as seamless and automatic as possible to encrypt/decrypt messages.

        Key words: "as possible". This does not make it easy or transparent.

        Currently, I have it set up to automatically sign my messages by default, though switching to automatic encryption is simply a matter of changing a menu option.

        This shows your lack of understanding of the problem. Sure, you could just "flip the switch", but think about how that has to work. To encrypt a message to someone, you have to have their public key. This requires the user to make a concious choice to get another person's public key before they can send an e-mail. Do you really think Grandma is going to ask for my public key before sending me an e-mail? I know all about these things, and *I'm* not going to bother to do it.

        The only way encryption is ever going to be mainstream is if it's supported at the SMTP level -- I send a query to an e-mail recipient for their public key, it gets sent back, I encrypt, then send the mail. That's the ONLY way it's ever going to happen.

        Unfortunately, it also means reworking a lot of how SMTP works, including SMTP forwarding, etc. Not to mention the authentication problems imposed by this solution (man in the middle substitutes a different public key, for example).

        The other way it could be done is to have a centralized public key registry index by e-mail address, but who runs it? Who pays for it? And how do you get all the e-mail clients to recognize it as an authority? Probably the way it should be done is decentralized, somewhat like DNS.

        There's a reason these problems haven't been solved up until now: they're EXTREMELY difficult.

    • Of course, the fact that it's extremely difficult (if not impossible) to make it fully automatic for the users has nothing to do with it

      Actually, while the setup is still not idiot-proof, actually using gpg in mutt is really, really easy, and works exactly the way I like. I automatically sign everything I send. mutt caches my password in memory so I don't have to type it over and over when sending a quick succession of emails. I automatically verify incoming signed emails, and download their keys if I don't have them from the keyservers automatically. Mutt gives me a status on whether the web of trust includes the key signing a letter. Dunno about encryption, since I can't find anyone else using pgp/gpg with encryption to find out with....
  • Spam I can't read!

  • Will this result in ubiquitous encryption? (Score:1, Insightful)

    by Anonymous Coward
    In a word: no.

    The thing holding up encryption isn't Mandrake, or Linux, or the NSA. It's making it easy for my mom to use when she sends me a hoax chain letter from her AOL account, promising me that Bill Gates is going to send me $500 if I forward it to all my friends too.

    Seriously, though, it's the least common denominator. Maybe with the adoption of DNSSEC and SMTP extensions we can eventually have pseudo end-to-end encryption handled by the mail servers themselves. But until the more common email clients perform encryption on their own, no pgp keys to import, etc., don't look for my mom to start using it.

    • Eh, how precisely is this magical encryption supposed to take place without any key exchange? You might be able to have "secure" email between a mail client and a mail server by using SSL, but the message itself can't be encrypted to a specific recipient without a shared key (or else how would that recipient - and only that recipient - decrypt it?).

      The way to make mail encryption prolific is to make key creation, key escrow, and key exchange a simple process. Personally, I think the best way to handle that is to establish a government program for the issuance and authentication of "Internet ID's". Basically, a person applies for an IID by providing verified proof of their identity, then they are issued a smartcard which contains their secret key. To use the card, you need a smartcard reader on your PC (or a cheap aftermarket USB reader). When you want to send a key signed email or decrypt an encrypted email send to you, you insert your card in the reader, and type in your password or PIN.

      When someone receives a signed email from you, they don't need to exchange your public key with you, since their software automatically connects to the government key server via the Internet, requests your public key and verifies the signature. Likewise, when they want to send you mail, their mail client searches the federal key database for the recipient's key, and if available, either offers the option to encrypt, or does so automatically (a user-defined option).

      Of course, the NSA and the National Security Council will likely poo-poo such a plan, unless of course they are allowed to escrow the secret keys, thus enabling them to decrypt anyone's email. I don't know that this is such a big deal though, since unless you regularly encrypt your email, the government is already reading it.
      • > Eh, how precisely is this magical encryption supposed to
        > take place without any key exchange?

        PGP and GPG work on public-key principles. In brief, there
        are _two_ keys, one used to do the mangling and the other used
        to do the unmangling. One of these two keys is public, and the
        other is (supposed to be) not shared. If you encrypt with your
        private key, then anyone can read it (with the public key, which
        is shared), but they can verify that it was encrypted by the
        holder of the private key. If you want only one party to be
        able to read it, you get his public key (which is publically
        shared) and encrypt with that, and then his private key (which
        you don't have) is needed to read it.

        The thing holding common encryption of email back is plain
        and simple: to almost everyone, the privacy of encrypted
        mail is unnecessary, but knowing that the recipient will be
        able to read the message (whether his mail client knows
        about encryption or not) is important. Encrypted mail is
        really only useful if the person you're sending the message
        to maintains a publically available public key and keeps
        his private key private on a secure system. No amount of
        client support will change that. However, client support
        _does_ mean that people who specifically want to exchange
        encrypted mail with one another can, without a lot of
        technical knowledge. But people who don't need the privacy
        of encrypted mail still won't bother, and I don't see how
        that's a bad thing. People who don't mind getting phone
        calls don't have unlisted numbers, either. Some of us just
        don't have a lot of really sensitive information that would
        be any huge disaster if random people found out about it.
        Those of you who do can use the feature when exchanging
        mail with one another, and the rest of us can ignore it.

        Just wait until the spammers get the wrong idea and start
        sending encrypted messages, advertising encryption software
        like as not...

  • just in time (Score:2, Insightful)

    by Scaebor ( 587064 )
    are we at the dawn of that golden age when encrypted email will be commonplace?

    And with the coming of quantum computing as reported in past articles, this golden age, like any, will have a definite ending point

    • The existance of quantum cryptography, while being infinitly strong, dosent make things before it automaticly week. PGP/GPG is "good enough" and will be for a long, long, time.
    • What do you want to bet that the government will try to make quantum computing a munition? Or illegal for private citizens or soemthing?

  • The correct link (Score:1, Redundant)

    by RPoet ( 20693 )
    Don't the slashdot editors even click the links in the article they post?

    This is the correct link [mozdev.org].

  • Gentoo ships enigmail with moz1.1 (Score:5, Informative)

    by Tester ( 591 ) <olivier@crete.ocrete@ca> on Sunday September 15, 2002 @01:33PM (#4261270) Homepage
    I'd like to point out that the mozilla 1.1 ebuild in gentoo actually includes enigmail... But yes I know that it is still masked for some reason that's outside of my understanding.

    • Re:Gentoo ships enigmail with moz1.1 (Score:4, Insightful)

      by DataShark ( 25965 ) on Sunday September 15, 2002 @01:36PM (#4261286) Homepage


      its only masked because we are in a feeature freazee pendin the release of gentoo 1.4 ... The first distro fully optimized for gcc3.2 (currently we are at rc1 stage)

      Regards
      • its only masked because we are in a feeature freazee pendin the release of gentoo 1.4 ... The first distro fully optimized for gcc3.2 (currently we are at rc1 stage)

        I doubt that.

        Mandrake 9.0, which according to various sources within Mandrakesoft (specifically Warly, who is the guy who makes these decisions), will be released within two days of September 15, iow, within the next two days.

        Will Gentoo beat Mandrake to the punch?

  • Wrong, Gentoo was the first (Score:3, Informative)

    by fire-eyes ( 522894 ) on Sunday September 15, 2002 @01:34PM (#4261275) Homepage
    freenode.net #gentoo asked me to do this.

    Gentoo was the first, and yes, gentoo IS major.

  • Because we are not all paranoid?

    What's next? Scrambling your voice over the telephone?
    • Because it's the same as sending an email.
    • These already exist for the commercial market. They may not be third generation secure telephone units like the feds use (STU III) but they do use a government standard. Take a look at the link: http://www.securitymanagement.com/library/001273.h tml [securitymanagement.com] and scroll down a few items

    • What's next? Scrambling your voice over the telephone?

      http://www.pgpi.org/products/pgpfone/ [pgpi.org]

    • Re:No. (Score:5, Insightful)

      by Jeremiah Cornelius ( 137 ) on Sunday September 15, 2002 @02:03PM (#4261398) Homepage Journal
      > No. Because we are not all paranoid?

      >What's next? Scrambling your voice over the
      >telephone?

      You really don't get the point about common-place message encryption yet.

      I hope I can illustrate this in a helpful way, without appearing to condescend:

      All plain-text e-mail - without encryption - can be likened in the snail-mail model, to a post-card. The message contents, sender and receiver, are all in plain view of anyone who might take a notice. At its most mundane, message cryptography can be seen as providing the equivalent of a digital envelope.

      Of course, e-mail is not a postcard. In fact, the situation is better compared to sending postcards through a system which photocopies your message every time it passes through another station or container in its transit.... Oh, and every time it is photocopied, it is done by a different individuals and agencies, many of whom you may never have had any prior contact or relationship.

      The desire to manage who has access to thecontent of such messages is not paranoia. If you are in the habit of sending e-mail in the context of any business, deploying encryption and certificate technologies would fall under the domain of "Due Dilligence". Not using them routinely would constitute failure to exercise "Due Care" - both of which have considerable legal and regulatory implications.

      If you are an executive, a middle-manager or systems administrator, a tool like PGP now enables mail as a trusted path for exchange within your own organization sensitive information that would otherwise have to be circulated by more cumbersome means.

      When you consider the wide variety of purposes for which most all people use SMTP as a transport, it is irresponsible to marginalize the use of encrypting mechanisms, or to view advocates of their use with suspicion.

      Or, you can keep stapling your phone-bill to a 3x5 card! ;-)


      • Excellent explanation. Mod parent up!!!!
      • I don't think you get it. The fact is, some people (like me for instance) are not at all bothered by what you describe. I understand what you say, and actually, I don't usually mind copies of my emails sitting on servers all around the world.

        Of course, I have nothing against anyone using encryption. I'd use it myself if I felt it was needed for a particular message. But I don't see ubiqitous encryption as a golden age.
        • So,
          If the U.K. govenment starts the monitoring and surveillance of Nationals who have made repeat visits to countries governed by suspect regiemes (Vietnam), or home to significant revolutionary guerilla movements (Peru), you would have no objection?

          If -- by extra-legislative intelligence agreements -- they shared this information with unaccountable foriegn agencies in the U.S., Canada and Australia... You'd still be comfortable with that? I'm sorry if I have taken the argument closer to the "paranoia" scenario.

          I take your point about "Golden Age" hyperbole. But the issues are farther reaching, by implication, than even most well-informed people are aware of.

          • Your comments deserve a reply. As it happens, I am a British citizen and I have also been to both Peru and Vietnam - so I suppose that means I might be a target for surveillance... Well, that's fine by me. I have nothing to hide.

            I also don't have a problem with government agencies sharing information in order to track down the real crooks. International cooperation is important. The real crooks are probably using strong encryption anyway. At least MI6 and the CIA will be able to eliminate me from their enquiries quickly 8-)
            • Exactly what I'm getting to. I -of course- know about your national origins and specific travels, because you thoughtfully include a personal URL on /.

              I am glad you are unconcerned by the free traffic of personal and sensitive communications into hands of unintended recipients with indeterminate motives.

              I think it naive to view MI6, etc. as "Good Guys" who will accurately use this intelligence to correctly identify "Bad Guys". The historical performance by U.K. and U.S. on these counts is miserable. Sometimes the "Bad Guys" are villagers trying to clean up foreign polluters in Malaysia, or people like Nelson Mandela... I won't try to convince you further on this point. Read, and draw your own conclusions.

              Even when the agenda and motive of, say MI6, are not in doubt, do you want to be Mr. Buttle from Brazil?

              Oh, and the "Bad Guys" aren't generally using strong encryption. This was one of the Red Herring issues in the pseudo-intelligence speculation after 9/11. Talking Heads from "expert" think-tanks spouted these claims like mad, and started a mini craze on searching for encrypted terror communiques. Never happened. All the communications were plain text and regular phone conversations. The interviewees last week on Al Jazeereh explained clearly how coded phrases were used to pass information on open channels.

              What is harmful in your attitude is that you imply there is again something criminally suspect in the casual use of encryption technologies. I refer you to my earlier post in this thread - There is potential criminal and civil liability in NOT employing encryption, when commonly available.

              • So, Mr Cornelius. I seem to have underestimated you. It appears that my evil plan to hide my nefarious activities in Peru and Vietnam by publishing the information openly on the internet has badly backfired...

                In all seriousness, I don't see the use of strong encryption as necessarily suspect. I think everyone should make up their own mind on that, based on their view of what they do and don't mind others knowing about themselves. I personally would only bother with it for something that I wanted to keep private. Some things [goldby.net] are just too boring to bother keeping private ;-)

                And yes, I stand corrected on the 11 Sept stuff - now you mention it I do remember hearing that codewords were used instead of encryption.

  • Golden Age Ahead (Score:5, Funny)

    by RPoet ( 20693 ) on Sunday September 15, 2002 @01:36PM (#4261284) Journal
    "With this and Evolution and Kmail both supporting GPG and PGP are we at the dawn of that golden age when encrypted email will be commonplace?"

    Yes, definitely. With the three most popular e-mail clients in the world (Mozilla Mail, KMail and Evolution) all supporting encryption, I'm sure e-mail encryption will finally be the rule.
    • > With the three most popular e-mail clients in the world (Mozilla Mail, KMail and Evolution) all supporting encryption

      I hear some folks are using Outlook and Outlook Express, too. ;-)
    • Yes, definitely. With the three most popular e-mail clients in the world (Mozilla Mail, KMail and Evolution) all supporting encryption, I'm sure e-mail encryption will finally be the rule.

      Please, AxelTorvalds was obviously talking about the Linux world. You could also object that he said "the first major distributor" instead of "the first major GNU/Linux distributor". What's the need for a cheap shot ?. How about being a bit nicer to other posters ?.

    • Not necessarily, encryption of mail will still require people to actually understand the principles of public-key cryptography and distribute their public-key so people can encrypt mail to them, and as far as I know, neither kmail, evolution or mozilla integrates an option to export your public key to a keyserver (Although gpg/pgp does).

      Personally I don't think the golden age of mail cryptography is at hand, although I wish it was, but all in all I would prefere a golden age of digital signatures more than anything.

      • Re:Golden Age Ahead (Score:3, Informative)

        by MonMotha ( 514624 )
        Enigmail menu in mozilla has an "Insert Public Key" option, and it will import them for you upon request when they have been inlined (which is all that menu option does).

        A person would still have to know that people need their public key in order for anything to work, but the option to send it is there.

  • Commonplace Encryption? Not Yet. (Score:4, Insightful)

    by wandernotlost ( 444769 ) <[moc.cigamliart] [ta] [todhsals]> on Sunday September 15, 2002 @01:37PM (#4261288)

    ...are we at the dawn of that golden age when encrypted email will be commonplace?

    Nope. Not until all the most popular mail clients include functionality to make it ridiculously easy for a nontechnical user to use encryption (including key generation and management), will we see commonplace encrypted email. The inclusion of an extension to mozilla on a linux distribution hardly fulfills this requirement.


    • http://www.ietf.org/rfc/rfc2440.txt [ietf.org]

      what clients would actually need to support this for it to become really standard ?

      Outlook (express)
      Eudora
      Lotus Notes

      I cant think of any more really can you ?

      regards

      John Jones
      • what clients would actually need to support this for it to become really standard ?


        Outlook (express)
        Eudora
        Lotus Notes

        I cant think of any more really can you ?

        Well, netscape, on windows and mac, but the point really is the ridiculously easy GUI. The average user doesn't know or care enough to figure out how to generate a key and send it to a keyserver - or to manage the private key between machines. Thus the mail client would have to make this really simple. As someone else mentioned, probably the most difficult part is managing the private key between machines, which the software can't necessarily handle anyway.

  • What we need is freenet-like email (Score:4, Insightful)

    by BESTouff ( 531293 ) on Sunday September 15, 2002 @01:41PM (#4261309)
    Now that the various governments have decided to monitor the email you sent and receive, just encrypting isn't enough.

    What we need is a way to be able to send mail to anyone without you ISP/whatever to be able to notice. And no, just running an SMTP on your linux box isn't enough.

  • No (Score:4, Insightful)

    by anthony_dipierro ( 543308 ) on Sunday September 15, 2002 @01:43PM (#4261320) Journal

    With this and Evolution and Kmail both supporting GPG and PGP are we at the dawn of that golden age when encrypted email will be commonplace?

    No. The biggest problem with public key encryption is that you can't use it on multiple computers without some way of transferring the private key. Plus you have to keep a backup of your private key somewhere outside your main computer's location, yet somewhere it will remain secure.

    So, ultimately, unless you carry around a CD everywhere you go, you're probably relying on passwords in the end anyway.

    • ...
      unless you carry around a CD everywhere you go, you're probably relying on passwords in the end anyway.

      I've got a usb keychain filesystem with my
      keys on it for just that purpose.

    • Re:No (Score:5, Insightful)

      by Alan ( 347 ) <arcterex@NOspAm.ufies.org> on Sunday September 15, 2002 @02:37PM (#4261523) Homepage
      This is where those little USB keychain hard drives will become useful... just carry it around with all your other "keys" :)

      • Excellent Idea, but it needs more work (Score:5, Insightful)

        by tweakt ( 325224 ) on Sunday September 15, 2002 @04:06PM (#4261871) Homepage
        YES! I've been wanting to do this. It makes me wish that there was a way to better integrate the concept with things like PGP/GPG, etc.

        To the best of my knowledge, PGP looks at a path you specify for the keyring files, now on windows I imagine when you stick the USB keychain disk in, it gets whatever available drive letter it gets. So them you have to go set PGP to look at the right drive.

        Under linux I guess it would always mount to the same path, but how does the system know what user inserted the card? Would it mount as UID root? Thats not good. If it's formatted ext2 I guess the UIDs would have to match. But thats weak.

        What i'm thinking is PGP (etc) need an API so you can press a button that says "I am going to stick in my keychain with my keyrings on it now", and when the device is detected, the system only allows PGP access to read it, and only to the current user.

        Dunno if that makes sense, but the USB keychains are perfect for that sort of thing, cause your private never needs to be readily available unless you're actively using it. And then only breifly. Leaving it sitting in ~/.pgp (or "C:\Documents And Settings\Application Data\Network Associates\PGP") is just uneeded risk.

        • I know mentioning this is wankery, but on AmigaDOS you can refer to a device by its device name (Perhaps DH0: or DF0:) or by its volume name (Dave's Zip 100: or Schnozzwanger: or whatever). Furthermore filesystems were pluggable and the filesystem driver could be installed to the partition so it would work on any AmigaDOS machine that you could plug it into.

          Why the hell doesn't everyone do this? I guess Solaris will at least mount cdroms by both volume name and cdromn, that's way the hell ahead of most operating systems.

        • A key stored on a USB device is just a step up from putting it on your hard drive. If someone has access to your FS, no doubt they have access to read the contents of your USB device when inserted... Just check the interupt, then read!!!

          Something like S/Key or a smartcard is a far better solution. At least then a keystroke logger can't record your pass, then copy your key file. (well it can, but it's not of any use)

        • What i'm thinking is PGP (etc) need an API so you can press a button that says "I am going to stick in my keychain with my keyrings on it now", and when the device is detected, the system only allows PGP access to read it, and only to the current user.

          Maybe it's a totally different method, but I'm reminded of the way Ogle DVD doesn't actually mount the DVD disc to play the movie, and how you have to click "Open Disc" to start playback.

    • Re:No (Score:2)

      by imr ( 106517 )
      So, ultimately, unless you carry around a CD everywhere you go, you're probably relying on passwords in the end anyway.
      Why not? So many people already carry bags full of useless stuff, so why couldnt they add a cd or disk or minidisc or whatever small thing is needed?

      • Why not? So many people already carry bags full of useless stuff, so why couldnt they add a cd or disk or minidisc or whatever small thing is needed?

        At that point the problem becomes the fact that I can't easily add the key temporarily to Netscape or IE or Outlook. I need to be able to access email easily on the go. A simple PGP module built into IE would solve the problem for the most part. But instead Microsoft counts on passport... Bleh.

        • which is why mutt is such a great client.

          since it's console-based, you can always get your mail system, without dealing with configuring the box you're on. And it's had GPG tied in for ages.

          www.mutt.org

          • which is why mutt is such a great client.

            But that ultimately relies on passwords and trusting your hosting provider. I already use an SSL connection to my IMAP account through Outlook, or an https connection to my web-based email. Yes, GPG would protect the email en route to my server, but for the hassles to the people sending the email it's just not worth it.

        • Re:No (Score:2)

          by imr ( 106517 )
          yes, politics seems more the problem than ease of use (wether the program ergonomy or the data carrying angle).
    • The biggest problem with public key encryption is that you can't use it on multiple computers without some way of transferring the private key.

      I'd like a web client that can do the public key stuff on the server. It's nice to be able to check your mail with just a https:// capable web browser, without having to install stuff on the computer you want to use.

      I used to prefer using mutt over ssh, but you often cannot find ssh at cyber cafes and such. Web mail always works.

      steveha

  • Important notes! (Score:3, Informative)

    by ekrout ( 139379 ) on Sunday September 15, 2002 @01:43PM (#4261321) Journal
    Here are some good things to know in case you didn't read all of the Tutorial/FAQ at the Enigmail web site:

    Is Enigmail working?
    If installation was successful,
    you will need to restart the browser. (On Windows 9x/ME systems, you may sometimes need to reboot before restarting.) After restarting the browser, launch the Mail/News window, which should have an Enigmail menu on the menubar. Choose the About Enigmail option, which should display the version number and the PGP/GPG executable details.
    Enigmail has only been tested with milestone releases of Mozilla. If you use a daily build (or your own build) of Mozilla, Enigmail may not work and may even crash your build!

  • So why isn't this standard in Mozilla? (Score:3, Insightful)

    by Animats ( 122034 ) on Sunday September 15, 2002 @02:01PM (#4261395) Homepage
    As someone else pointed out, a plug-in for a minor Linux distro does not widespread adoption make.

    Mozilla should have the ability to receive all major forms of encrypted mail as standard. (As with other formats, the "player" needs to be more widely distributed than the "authoring" program.) That will help Mozilla's market share.

    I'd like to see Mozilla marketed as "the browser for business" - popup blocking, encrypted mail, spam filtering, virus blocking, etc. Contrast this with Microsoft Explorer, which is a home entertainment center whether you like it or not.

  • Do NOT encrypt your email. (Score:3, Funny)

    by FreeLinux ( 555387 ) on Sunday September 15, 2002 @02:14PM (#4261432)
    This sounds all wrong but, read this [satirewire.com] and think about it.

    Please, don't use encryption!!!
    • hmmm... satire wire tells you not to do something. I have this sneaking suspecion that they were being sarcastic.

      The point was that since encryption isnt very wide spread, weather or not an email is encrypted tells you alot... which is bad. While the content is encrypted, the headers are not, which means if someone sees that you are sending encrypted mail, they will know who is sending it and who is receiving it and will become suspecious. This is actually a very good argument for proliferation of encryption, and use of encryption on everday "boreing stuff".
  • and easy to use, but perhaps a bigger issue is that the majority of the internet-using, mail-sending world has no concept of certificates and public/private key pairs; really, PKI in general. Still we have to start somewhere, so this is a step in the right direction.

  • RFC3156 (Score:3, Informative)

    by Glytch ( 4881 ) on Sunday September 15, 2002 @02:43PM (#4261547)

    Thank god they follow the MIME/OpenPGP standard! Now maybe us Sylpheed users will be able to decrypt email from non-Sylpheed users without having to jump through a slew of goddamn copy-to-clipboard hoops.

    Email client developers, take note. [faqs.org] Please don't reinvent the wheel. It only slows down adoption of encryption.

  • ``...are we at the dawn of that golden age when encrypted email will be commonplace?''
    No, because M$ Outlook [Exress] doesn't have it enabled by default.

  • What's the point (Score:3, Insightful)

    by bogie ( 31020 ) on Sunday September 15, 2002 @03:04PM (#4261628) Journal
    of encrypting your email when every time you check it, you send your password in clear text across the net. This drives me absolutely insane. Why TF do 99% of all ISP's and webhosts still use insecure authentication? Yes if you encrypt all of your emails and if everyone who ever emails you encrypts their's your a step up, but that clear text thing kinda makes it all worthless.

    Why has this most glaring of all security problems not been addressed for the general public? Why Why Why Why?

    Want hear something funny and typical. My webhost for my business which also does my email, requires SSH to log into my shell account to do things like upload files to changes my website etc. But I have to use the same fricking logon and password to check my email. Does that make any sense at all? I'd out them right now so you would know not to use them but I don't want my website cut off.

    O.K. just relax.....I'm on a beach.....
    • "you send your password in clear text across the net"

      Well, dunno about you, but I don't. Have ssh, will travel.

      There's also no need to do so with POP either - APOP and POP-over-SSL both exist.

      Besides, if the mail is encrypted, what's the point in intercepting the POP3 password? Isn't that exactly why you *should* be encrypting the mail?
      • "Well, dunno about you, but I don't. Have ssh, will travel."

        And this helps the 99% of people who use regular POP3 how?

        "There's also no need to do so with POP either - APOP and POP-over-SSL both exist"

        And how many ISP's use this?

        "Besides, if the mail is encrypted, what's the point in intercepting the POP3 password? Isn't that exactly why you *should* be encrypting the mail? "

        If every email that is ever sent to you is encypted your fine. If even one of them is not that is "the point in intercepting the POP3 password".
        • "And how many ISP's use this?"

          Most, that I've seen. If not, what are you doing whining here?
          But it really is an insignificant concern, as long as the mails you want to have encrypted are sent encrypted, anyway.
    • You may have trouble believing this, but it is possible to use a different password for your pop account than what you use for your pgp key.

      Even more shocking, secure IMAP and POP does exist.

      /joeyo

      • "You may have trouble believing this, but it is possible to use a different password for your pop account than what you use for your pgp key. "

        Gee really. The point is 1) most people don't use pgp and 2) your logon and password is still going across the net unencrypted. So unless every email ever sent to you is encrypted I can sniff you packets and then read your emails on your server before you even get them.

        "Even more shocking, secure IMAP and POP does exist."

        Again no Sh**t. What percent of the general public uses this? Right.
    • Before any else responds read my post again. I am NOT stating the secure email is not possible, I am stating that if you ever get sent a non-encrypted email it negates PGP until everyone uses it. That is not to say PGP should not be used, just that secure authentication is integral to secure email. I don't see what's see difficult to understand here.

      Also like I clearly stated. This is a real problem for the 99% of users who don't use PGP and are on a regular POP3 server.
      • Um. PGP supplies both secure authentication and secure communication. Secure authentication is provided by signing an outgoing email. Secure communication is provided by encrypting an outgoing signed email. The only thing that regular cleartext password exchange on POP3 messes up is secure availability. That is, someone could get your password and start deleting incoming emails that were for you.

        You are of course correct: The benefits of PGP are not confered upon email correspondents that do not use it. You also said, "Yes if you encrypt all of your emails and if everyone who ever emails you encrypts their's your a step up, but that clear text thing kinda makes it all worthless. "

        And that is not correct at all. If everyone you correspond with uses PGP, and all your passwords are sent in cleartext, then no one can impersonate you, and no one can snoop your email. They could only delete your incoming mail. That's a pretty significant step up.
    • You sure they don't have imaps or some sort of ssl tunnel?

      Is the shell host near the mail host, or the same one? You could ssh-tunnel to the shell host and then log in to the mail host from there.
  • Swedish-Chef Google [google.com] search on enigmail.

    Great news for enig, but what about the other distros? Will this news carry any weight, giving the other offerings a desire to carry enigmail?

    What about ximian support?

  • Seems to get included in more distros (Score:3, Informative)

    by OSSturi ( 577033 ) on Sunday September 15, 2002 @03:39PM (#4261766)
    A week ago I've downloaded the 1.1 mozilla rpm from SuSE's ftp-server. It came with enigmail included as well. So this seems to get a standard part of more distros. This is a good thing.
  • Evolution shipped with the last version with PGP support IIRC

  • Golden age? (Score:3, Insightful)

    by IamTheRealMike ( 537420 ) on Sunday September 15, 2002 @04:03PM (#4261864)
    What's this talk of a golden age? An age where we are all so paranoid that we encrypt our mail routinely? Sounds like a world ruled by fear more than anything. I for one have nothing to hide, and want no part in it.

  • Great! (Score:3, Insightful)

    by jmd! ( 111669 ) <jmd.pobox@com> on Sunday September 15, 2002 @06:17PM (#4262381) Homepage
    Great, PGP support is included. Now all they need to figure out is how to package enough clue inside the box so people can properly use it.

    The OpenPGP and it's public keyring trust system are very complex and not something most users will ever understand. And there are so many other weak links in the chain that it just turns out to be overkill.

    Anyone have ideas on how secure e-mail could be brought to the masses? Because shipping PGP is not it. PGP has been around a long, long time (in Internet years), and if there was demand, it would have taken off already.

  • The Golden Age? Nah... (Score:3, Interesting)

    by Arandir ( 19206 ) on Sunday September 15, 2002 @07:26PM (#4262693) Homepage Journal
    are we at the dawn of that golden age when encrypted email will be commonplace?

    No.

    There are still two important pieces missing. Without them the non-geek will not be using encrypted email.

    The first is key generation. No matter how simple of a front end you have for it, the user still has to consciously sit down and create a strong key. We all know from experience that the average user will not want to do this.

    The second is even more problematic. That's key management. Where is the average user going to store their private keys? On their harddrive or on a floppy disk? And will they be conscientious participants in a web of trust?

    So far most proposed methods of automated key management have been detrimental to our privacy (Clipper chip, Passport, etc). But here's one idea: create and market a USB dongle that has a write-once key that is generated during its first use (or the user could initialize it with a preexisting key). Such keys would be automatically signed by the manufacturer. It might not work, but it's something to think about.

Slashdot Top Deals

Anyone can make an omelet with eggs. The trick is to make one with none.

Close